This vulnerability (CVE-2026-11836) in Caliptra Core ROM and Core Firmware arises from insufficient verification of data authenticity in the validate_debug_unlock_token() function operating in subsystem mode. It allows an attacker who has access to the integrator's debug unlock signing service to use a valid debug unlock token issued for one device to unlock debug mode on another device that shares the same debug unlock key hash. The 384-bit challenge nonce mechanism prevents replay attacks of previously issued tokens. The practical impact is limited to loss of per-device scope enforcement within a group of devices sharing the same unlock authority; it does not enable debug unlock on devices outside that group. Affected versions are Core ROM 2.0.0 through 2.0.2 and 2.1.0 through 2.1.1, and Core Firmware 2.0.0 through 2.0.1 and 2.1.0. There is no vendor advisory or patch information available at this time.

The impact is limited to the loss of per-device scope enforcement for debug unlock within a set of devices sharing the same debug unlock key hash. This means an attacker with access to the debug unlock signing service can unlock debug mode on unintended devices within that set. However, the vulnerability does not allow unlocking debug mode on devices outside this set, and replay attacks are prevented by the 384-bit challenge nonce. The CVSS 4.0 base score is 1.8, indicating low severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, organizations should monitor vendor communications for updates. There are no vendor instructions indicating that no action is required or that the issue is already mitigated.